GitLab Protect Stage, 24 Jun 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: How to integrate custom AppArmor profiles in your deployments

Description

Link to the documentation: https://docs.gitlab.com/ee/user/clusters/applications.html#install-apparmor-using-gitlab-cicd

A

Oh, hello, everyone: this is going to be a quickie demo on how you can integrate your ad armor profiles with your deployments. So here is the get lab documentation. That described is in basically two steps. The first step is that you need to set up a cluster management project, that's going to enable the armor installation and the same place your ago, also going to define which profiles you want to load at your cluster. The second step is to link Troopa limitations, your your the profile that you want to use for specific deployment.

A

The prerequisite for dayz is that you need to have a cluster shared among the two projects. In this case here, I have on a growth I set up the cluster on the group, and those two projects are between this crew and another thing to keep in mind is that if we go to advanced settings, we should set the cluster management app here.

A

Otherwise it doesn't have enough permission to perform the steps that we want to do. So if we move on to the cluster management app that I have it's a very basic set up here. That's the template that we use for classifications and then inside management, app folder under dock teeth, lab I'm gonna enable ingress for four bit for us to use the deployment later on and at armor and inside that armor folder.

A

That's the place that I'm gonna customize, which profiles I wanna load in so for this. For the sake of this demo, it's going to be a basic profile. That's called to deny pop under banned folder. So.

A

I have deployed that and I'm gonna quick show here things that you should look forward so on the step for app armor. If you run the pipeline for this project, you're going to see that that's the help chart installation for your app farmer- and here you should see in configure math, we should be able to see the profiles that you specify on your mail file.

A

If we move onto the app that we want to deploy in this case here, I have a very simple app: that's going to try to run through a batch script file and it's a docker file. That's going to copy this file to the docker image and run it. Let me show you the get live, CI ml.

A

You don't need all of this I, just let this for, for the sake of making simple and if we go to the important thing is here under dot gitlab. If we go to how to deploy values, tml you're, going to see the odds are huge, the lopata notation. So this is a this first part here is specific to at armor annotation in kubernetes.

A

This is the name of your of your pod of it of your container, and this is going to be default if you're using off the boil up apps- and this is the name of the profile- so they have to match it and then, if we go ahead and run this.

A

Little bit of time.

A

Okay, for the sake of keeping the video short I, have cut the steps prior to production and if we look into production, it's it's the deployments happening and then from here we can go to the cluster to see more in details, and here we see that there is a pod, that's getting deployed and there is an error and when we log into this pod, when we see the logs for this pod, we see that the permission was denied for the script because of our room and that's it for today.

A

Thank you very much for watching this video.